N-able N-central vulnerabilities allow remote code execution and full system takeover
TL;DR
N-able has taken its hosted N-central environments offline following the public disclosure of over 30 alleged zero-day vulnerabilities. Managed service providers and IT teams using N-central must shut down on-premises servers immediately until a patch is released.
What happened
Security researcher Sean Bales disclosed a massive collection of vulnerabilities in N-able's N-central remote monitoring and management (RMM) platform on November 8. The disclosure included a GitHub repository, Able2Shell, containing proof-of-concept exploits for flaws such as unauthenticated XML External Entity (XXE) injection, remote code execution (RCE), authentication bypass, and directory traversal.
One critical exploit chain uses the XXE flaw in the service-import functionality to steal a local session, reset account passwords, and execute commands as the nable user. This chain can also be used to create a new administrator account with attacker-controlled credentials.
In response to the disclosure, N-able took its hosted N-central environments offline across the Americas, Europe, and Asia-Pacific on November 9. The company is currently developing a hotfix to address the issues.
Why it matters
RMM platforms are high-value targets because they provide centralized control over customer networks. These vulnerabilities allow an attacker to move from unauthenticated access to full system takeover, including the ability to execute commands as root or the nable user. Because the researcher tested these flaws against a pre-release version (N-central Appliance 2026.4.0.31), there is a high probability that all current production versions are also vulnerable.
Who is affected
- N-able N-central (Hosted and On-premises)
- N-central Appliance 2026.4.0.31 (and likely earlier versions)
What to do now
- Shut down all on-premises N-central servers immediately.
- Install the N-able hotfix as soon as it is released and validated.
- Monitor systems for the creation of unauthorized administrator accounts or unexpected activity from the
nableuser. - Audit the service-import functionality for unauthorized file changes or suspicious activity.
What we don't know yet
- The specific CVE IDs or the exact number of vulnerable versions for the 30+ reported flaws.
- Whether any of these vulnerabilities have been actively exploited in the wild.
- The full scope of how these flaws impact older production versions.
- The status of the previously reported vulnerabilities in other N-able products mentioned by the researcher.
Sources
